,,ii #aaith ,,congress #b;d ,session ,s4 #ecfh ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,august #g1 #bjbf ,mr4 ,schiff 7for himself and ,ms4 ,klobuchar7 introduced the following bill2 which was read twice and referred to the ,committee on ,environment and ,public ,works ,a ,,bill ,to amend the ,safe ,drinking ,water ,act and the ,federal ,water ,pollution ,control ,act to establish or modify cybersecurity requirements for drinking water and wastewater systems1 and for other purposes4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,water ,cyber ,shield ,act of #bjbf4 7b7 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4 ,,title ,i--,drinking water infrastructure ,sec4 #aja4 ,community water system risk and resilience4 ,sec4 #ajb4 ,cybersecurity requirements for drinking water systems4 ,sec4 #ajc4 ,reauthorization of midsize and large drinking water system infrastructure resilience and sustainability program4 ,sec4 #ajd4 ,drinking water security assistance4 ,,title ,,ii--,clean water infrastructure ,sec4 #bja4 ,treatment works risk and resilience4 ,sec4 #bjb4 ,cybersecurity requirements for treatment works4 ,sec4 #bjc4 ,reauthorization of the clean water infrastructure resiliency and sustainability program4 ,sec4 #bjd4 ,clean water security assistance4 ,,title ,,iii--,cyber incident reporting obligations ,sec4 #cja4 ,cyber incident reporting4 ,i ,drinking water infrastructure #aja4 ,community water system risk and resilience ,section #adcc of the ,safe ,drinking ,water ,act 7#db ,u4,s4,c4 #cjj;i-#b7 is amended-- 7#a7 in subsection 7a7-- 7,a7 in paragraph 7#a77;,a7-- 7i7 in clause 7ii71 by striking storage and distribution facilities1 electronic1 computer1 or other automated systems 7including the security of such systems7 which and inserting and storage and distribution facilities that2 7ii7 in clause 7v71 by striking and at the end2 and 7iii7 by adding at the end the following3 7vii7 using a method approved by the applicable ,state1 the risks to electronic1 computer1 or other automated systems for the purpose of identifying significant cybersecurity risks that have the potential to cause the impacts described in subparagraph 7,a7 or 7,b7 of paragraph 7#b72 and 2 and 7,b7 by striking paragraphs 7#c7 through 7#e7 and inserting the following3 7#c7 ,review and revision 7,a7 ,in general ,each community water system described in paragraph 7#a7 shall1 not less frequently than once every #e years1 review and1 if necessary1 revise the assessment4 7,b7 ,certification to the ,administrator or ,state ,on completion of the review under subparagraph 7,a71 a community water system described in paragraph 7#a7 shall submit to the applicable ,state a certification that the community water system has reviewed and1 if applicable1 revised the assessment4 2 7#b7 in subsection 7b7-- 7,a7 by redesignating paragraphs 7#a7 through 7#d7 as subparagraphs 7,a7 through 7,d71 and indenting appropriately2 7,b7 in the matter preceding subparagraph 7,a7 7as so redesignated71 by striking ,each community water system in the first sentence and all that follows through ,the emergency response plan in the third sentence and inserting the following3 7#a7 ,in general ,each community water system serving a population greater than #c1cjj shall prepare an emergency response plan that incorporates findings of the assessment conducted under subsection 7a7 for that community water system 7or any revisions to that assessment74 7#b7 ,required inclusions ,the emergency response plan of a community water system under paragraph 7#a7 2 7,c7 in paragraph 7#b7 7as so designated7-- 7i7 in subparagraph 7,a7 7as so redesignated71 by striking and cybersecurity2 7ii7 in subparagraph 7,c7 7as so redesignated71 by striking and at the end2 7iii7 in subparagraph 7,d7 7as so redesignated71 by striking the period at the end and inserting 2 and2 and 7iv7 by adding at the end the following3 7,e7 countermeasures that the system intends to adopt or1 if already in use1 maintain to mitigate the significant cybersecurity risks identified under subsection 7a77#a77;,a77vii71 including a schedule the system intends to follow to adopt any countermeasures not already in use by the system4 2 and 7,d7 by adding at the end the following3 7#c7 ,review2 revision ,a community water system serving a population greater than #c1cjj shall review and1 as necessary1 revise the emergency response plan prepared under this subsection not less frequently than once every #e years4 2 7#c7 by striking subsection 7f72 7#d7 by redesignating subsections 7c71 7d71 and 7e7 as subsections 7d71 7e71 and 7f71 respectively2 7#e7 by inserting after subsection 7b7 the following3 7c7 ,submission and approval of assessments and plans 7#a7 ,submission 7,a7 ,in general ,each community water system subject to subsections 7a7 and 7b7 shall1 during a cybersecurity assessment pursuant to section #adcc;,a7b77#a77;,a71 provide to the applicable ,state-- 7i7 the portion of the assessment prepared under subsection 7a7 that is described in paragraph 7#a77;,a77vii7 of that subsection 7including any revision to that portion of the assessment72 and 7ii7 the portion of the emergency response plan prepared under subsection 7b7 that is described in paragraph 7#b77;,e7 of that subsection 7including any revision to that portion of the emergency response plan74 7,b7 ,limitation ,neither the ,administrator nor a ,state may require the submission of any portion of an assessment under subsection 7a7 or an emergency response plan under subsection 7b7 that is not described in subparagraph 7,a74 7#b7 ,review2 approval 7,a7 ,in general ,a ,state shall-- 7i7 review the portions of the assessments and emergency response plans of community water systems submitted pursuant to paragraph 7#a77;,a7 for conformity with the requirements of this section and section #adcc;,a2 and 7ii7 7,i7 approve of the portions of an assessment and emergency response plan submitted pursuant to paragraph 7#a77;,a72 or 7,,ii7 disapprove of the portions of an assessment and emergency response plan submitted pursuant to paragraph 7#a77;,a7 if the ,administrator or ,state1 as applicable1 determines that-- 7aa7 the submitted portions of the assessment or emergency response plan are missing1 incomplete1 or fail to conform with the requirements of this section or section #adcc;,a2 or 7bb7 the submitted portions of the assessment or emergency response plan fail to provide for cybersecurity resilience in accordance with the baseline cybersecurity standards established by the ,administrator under section #adcc;,a7c74 7,b7 ,enforcement ,a ,state may use appropriate enforcement mechanisms under this title or the appropriate ,state authority to remedy noncompliance1 as described in items 7aa7 and 7bb7 of subparagraph 7,a77ii77,,ii71 under this subsection4 7#c7 ,submitted documentation 7,a7 ,applicability of ,,foia ,any information submitted under this subsection shall be exempt from disclosure under section #eeb7;b77#c7 of title #e1 ,united ,states ,code 7commonly known as the ,freedom of ,information ,act71 and any provision of ,state1 ,tribal1 or local freedom of information law1 open government law1 open meetings law1 open records law1 sunshine law1 or similar law requiring disclosure of information or records4 7,b7 ,treatment of documentation 7i7 ,protocol development ,not later than #ahj days after the date of enactment of the ,water ,cyber ,shield ,act of #bjbf and before any cybersecurity assessments are carried out pursuant to section #adcc;,a7b77#a77;,a71 the ,administrator1 in consultation with appropriate ,federal law enforcement and intelligence officials1 shall develop such protocols as are necessary to protect any information provided under paragraph 7#a77;,a7 to the ,state4 7ii7 ,requirements for protocol ,the protocol developed under clause 7i7 shall ensure that-- 7,i7 each copy of the portions of an assessment and emergency response plan submitted pursuant to paragraph 7#a77;,a7 are kept in a secure location2 7,,ii7 only individuals designated by the applicable ,state may have access to copies of the portions of the assessment and emergency response plan submitted pursuant to paragraph 7#a77;,a72 and 7,,iii7 no copy of the portions of the assessment and emergency response plan submitted pursuant to paragraph 7#a77;,a7 shall be made available to anyone other than an individual designated by the applicable ,state4 7iii7 ,savings provision ,nothing in this subparagraph authorizes any person to withhold any information from ,congress or from a committee or subcommittee of ,congress4 2 7#f7 in subsection 7e7 7as so redesignated71 by striking a certification of such assessment or plan is submitted to the ,administrator and inserting an assessment or plan is submitted to the applicable ,state12 and 7#g7 by striking subsection 7h7 and inserting the following3 7h7 ,definitions ,in this section3 7#a7 ,natural hazard ,the term natural hazard means a natural event that threatens the functioning of a community water system1 including an earthquake1 tornado1 flood1 hurricane1 wildfire1 and hydrologic changes4 7#b7 ,resilience ,the term resilience means the ability of a community water system or an asset of a community water system to adapt to or withstand the effects of a malevolent act or natural hazard without interruption to the asset's or system's function1 or if the function is interrupted1 to rapidly return to a normal operating condition4 7#c7 ,state 7,a7 ,in general ,the term ,state means a ,state that has assumed primary enforcement responsibility pursuant to section #adcc;,a7e74 7,b7 ,enforcement by the ,administrator ,if a ,state has not assumed primary enforcement responsibility pursuant to section #adcc;,a7e71 the term ,state shall1 for purposes of obligations of the ,state under this subsection1 be considered to be a reference to the ,administrator4 4 #ajb4 ,cybersecurity requirements for drinking water systems 7a7 ,in general ,the ,safe ,drinking ,water ,act is amended by inserting after section #adcc 7#db ,u4,s4,c4 #cjj;i-#b7 the following3 #adcc;,a4 ,cybersecurity requirements 7a7 ,definitions ,in this section3 7#a7 ,cybersecurity incident ,the term cybersecurity incident means a malicious act or suspicious event that disrupts1 or attempts to disrupt1 the operation of programmable electronic devices and communication networks1 including hardware1 software1 and data that are essential to the cybersecurity resilience of a public water system4 7#b7 ,cybersecurity resilience ,the term cybersecurity resilience means the ability of a public water system to adapt to or withstand the effects of a cybersecurity incident without interruption to the public water system's function1 or if the function is interrupted1 to rapidly return to a normal operating condition4 7#c7 ,state 7,a7 ,in general ,except for subsection 7e71 the term ,state means a ,state that has assumed primary enforcement responsibility pursuant to subsection 7e74 7,b7 ,enforcement by the ,administrator ,if a ,state has not assumed primary enforcement responsibility pursuant to subsection 7e71 the term ,state shall1 for purposes of obligations of the ,state under this section 7except for subsection 7e771 be considered to be a reference to the ,administrator4 7b7 ,cybersecurity assessments 7#a7 ,assessments required 7,a7 ,in general ,a ,state shall carry out cybersecurity assessments of public water systems in accordance with this paragraph4 7,b7 ,evaluation of adequacy ,for a public water system subject to a cybersecurity assessment under subparagraph 7,a71 if the public water system uses operational technology1 the ,state shall evaluate the adequacy of the cybersecurity of the operational technology1 and information and communications technology that is connected to the operational technology1 against the baseline cybersecurity standards promulgated by the ,administrator under subsection 7c74 7,c7 ,review of assessments and plans ,in carrying out a cybersecurity assessment required under subparagraph 7,a71 a public water system shall provide1 and the ,state shall review1 the portions of the risk and resilience assessments of the public water system under section #adcc7;a7 and the emergency response plans of the public water system under section #adcc7;b7 submitted under section #adcc7;c77#a77;,a74 7,d7 ,inspections ,in carrying out cybersecurity assessments under this paragraph1 a ,state shall carry out inspections of a representative sample of public water systems each year1 which sampling shall be informed by risk-based considerations1 subject to the condition that the scope of the inspection is limited to the systems of the public water system necessary to meet the requirements of this paragraph4 7#b7 ,violations ,if a ,state identifies a violation of the baseline cybersecurity standards established by the ,administrator under subsection 7c7 while conducting an assessment under paragraph 7#a71 the ,state shall take appropriate steps to ensure that the public water system addresses the violation and use mechanisms1 including enforcement1 for failures to correct those violations4 7#c7 ,submission to ,,epa 7,a7 ,in general ,a ,state shall annually submit to the ,administrator a report that summarizes the performance of the public water systems of the ,state for each cybersecurity performance metric established by the ,administrator under subsection 7d77#a7 based on the review by the ,state of risk and resilience assessments pursuant to paragraph 7#a77;,c74 7,b7 ,requirement ,a report submitted under subparagraph 7,a7 shall not identify any specific public water system and shall include only aggregations of data4 7#d7 ,technical assistance ,the ,administrator shall1 on request of a public water system1 provide guidance and technical assistance to the public water system with respect to-- 7,a7 implementing any requirement under this section or section #adcc2 and 7,b7 enhancing cybersecurity resilience4 7c7 ,baseline cybersecurity standards 7#a7 ,in general ,the ,administrator shall by rulemaking establish baseline cybersecurity standards that shall serve as requirements to provide for the cybersecurity resilience of a public water system4 7#b7 ,requirements ,in developing and establishing the baseline cybersecurity standards under paragraph 7#a71 the ,administrator shall1 at a minimum-- 7,a7 work in conjunction with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,director of the ,national ,institute of ,standards and ,technology2 7,b7 develop the baseline cybersecurity standards in collaboration with public water systems of various sizes and capacities to ensure that feedback from a variety of public water systems is considered during the development of the baseline cybersecurity standards2 7,c7 ensure that best practices and guidelines that already exist in the water sector at the time of the development of the baseline cybersecurity standards inform the development of the baseline cybersecurity standards2 7,d7 establish a technical advisory committee to provide input with respect to1 review1 and refine the baseline cybersecurity standards throughout the development process1 which shall1 at a minimum1 include-- 7i7 representatives from public water systems of various sizes2 7ii7 professional water associations2 7iii7 cybersecurity experts2 7iv7 a representative from a relevant voluntary consensus standards body1 as described in section #ab7;d77#a7 of the ,national ,technology ,transfer and ,advancement ,act of #aiie 7#ae ,u4,s4,c4 #bgb note2 ,public ,law #ajd-aac72 and 7v7 a representative from an information technology or operational technology service provider that provides cybersecurity services to public water systems2 and 7,e7 consult with the ,states4 7#c7 ,consideration of varied capacity and risk ,in developing the baseline cybersecurity standards under paragraph 7#a71 the ,administrator-- 7,a7 shall ensure that the baseline cybersecurity standards account for the varied capacity and risk of all public water systems2 and 7,b7 may establish different baseline cybersecurity standards for different categories of public water systems subject to assessments under subsection 7b7 based on capacity or risk4 7d7 ,cybersecurity performance metrics 7#a7 ,establishment of metrics 7,a7 ,in general ,not later than #b years after the date of enactment of this section1 the ,administrator shall establish cybersecurity performance metrics 7referred to in this subsection as the cybersecurity performance metrics7 to be used by the ,administrator to measure or assess how well the sector of public water systems in the ,united ,states is making progress on implementing cybersecurity best practices4 7,b7 ,assessment2 report ,the ,administrator shall1 not less frequently than once every #d years-- 7i7 assess the sector of public water systems in the ,united ,states using the cybersecurity performance metrics2 and 7ii7 submit to ,congress and make publicly available a report describing1 on a generalized1 sector-wide basis1 the state of public water systems sector performance using the assessment carried out under clause 7i74 7#b7 ,provision of information ,notwithstanding any other provision of law1 a public water system may1 at the discretion of the public water system and for the purpose of developing sector-wide risk assessments and performance metrics to measure how public water systems are making progress in developing and implementing cybersecurity best practices1 provide to the ,administrator1 and the ,administrator may accept1 information that would assist the ,administrator in the development and maintenance of cybersecurity performance metrics4 7e7 ,enforcement2 ,state assumption of duties 7#a7 ,in general ,this section and section #adcc shall be enforced by the ,administrator unless a ,state assumes primary enforcement responsibility pursuant to this subsection4 7#b7 ,application ,a ,state seeking to assume primary enforcement responsibility pursuant to this subsection shall submit to the ,administrator an application at such time1 in such manner1 and containing such information as the ,administrator may by regulation require4 7#c7 ,determination ,on receiving an application described in paragraph 7#b7 from a ,state1 the ,administrator shall1 based on that application1 determine whether the ,state-- 7,a7 has adopted and is implementing adequate procedures for the enforcement of requirements that are no less stringent than those under this section and section #adcc2 7,b7 has adopted authority and has sufficient capacity to impose enforcement remedies in line with those prescribed under this title2 7,c7 has sufficient capacity and personnel with sufficient expertise to perform cybersecurity assessments and conduct reviews of risk and resilience assessments and emergency response plans under section #adcc2 and 7,d7 has sufficient security mechanisms in place to prevent any unsanctioned disclosure or dissemination of risk and resilience assessments1 emergency response plans1 and any other information provided by a public water system1 in alignment with the protocols developed by the ,administrator under section #adcc7;c77#c77;,b77i74 7#d7 ,timeline ,not later than #ahj days after the date on which the ,administrator receives an application described in paragraph 7#b71 the ,administrator shall-- 7,a7 if the ,administrator determines that the ,state meets each requirement described in paragraph 7#c71 grant the application2 or 7,b7 if the ,administrator determines that the ,state fails to meet #a or more of the requirements described in paragraph 7#c71 deny the application4 7#e7 ,revocation of primary enforcement responsibility ,the ,administrator may1 as appropriate1 revoke an assumption of primary enforcement responsibility pursuant to this subsection if the ,administrator determines that a ,state no longer meets #a or more requirements described in paragraph 7#c74 7#f7 ,regulations required ,the ,administrator shall promulgate regulations carrying out this subsection not later than #a year after the date of enactment of this section1 which shall include-- 7,a7 the requirements for an application described in paragraph 7#b72 7,b7 the period for which a ,state may assume primary enforcement responsibility pursuant to this subsection before renewal2 and 7,c7 the manner by which the ,administrator may revoke primary enforcement responsibility pursuant to paragraph 7#e74 7#g7 ,savings provision ,an assumption of primary enforcement responsibility pursuant to this subsection shall be separate from any authority assumed under section #adac4 4 7b7 ,enforcement authority ,section #adad7;i77#a7 of the ,safe ,drinking ,water ,act 7#db ,u4,s4,c4 #cjj;g-#c7;i77#a77 is amended by inserting #adcc;,a1 after #adcc14 7c7 ,records and inspections ,section #adde7;b77#a7 of the ,safe ,drinking ,water ,act 7#db ,u4,s4,c4 #cjj;j-#d7;b77#a77 is amended1 in the first sentence-- 7#a7 by striking or 7,c7 any and inserting 7,c7 any2 7#b7 by inserting or 7,d7 a requirement to undergo an inspection under section #adcc;,a7a77#b77;,d71 after subsection 7a712 and 7#c7 by striking or 7,c71 is and inserting 7,c71 or 7,d71 is4 7d7 ,conforming amendment ,section #adac7;a7 of the ,safe ,drinking ,water ,act 7#db ,u4,s4,c4 #cjj;g-#b7;a77 is amended1 in the matter preceding paragraph 7#a71 by inserting 7except for sections #adcc and #adcc;,a7 after this title4 #ajc4 ,drinking water security assistance 7a7 ,authorization of appropriations ,in addition to any amounts authorized to be appropriated under section #adeb7m7 of the ,safe ,drinking ,water ,act 7#db ,u4,s4,c4 #cjj;j-#ab7m771 there is authorized to be appropriated #cjj1jjj1jjj for each of fiscal years #bjbg through #bjcb for the purposes of helping public water systems 7as defined in section #adja of that ,act 7#db ,u4,s4,c4 #cjj;f77 build cybersecurity resilience 7as defined in section #adcc;,a7a77#a7 of the ,safe ,drinking ,water ,act7 and identifying and mitigating cybersecurity vulnerabilities1 including those included in risk and resilience assessments and emergency response plans prepared pursuant to section #adcc of that ,act 7#db ,u4,s4,c4 #cjj;i-#b74 7b7 ,guidance ,the ,administrator of the ,environmental ,protection ,agency may issue guidance to determine specific criteria for eligible uses of the amounts made available under subsection 7a7 that further the purposes described in that subsection4 7c7 ,prioritization ,in using amounts made available pursuant to subsection 7a71 a ,state shall prioritize providing assistance to public water systems 7as defined in section #adja of the ,safe ,drinking ,water ,act 7#db ,u4,s4,c4 #cjj;f77 that have the greatest need with respect to capacity1 workforce1 expertise1 or resources to adequately address cybersecurity vulnerabilities4 7d7 ,rollover ,to the extent that any amounts authorized to be appropriated under subsection 7a7 in a fiscal year are not appropriated in that fiscal year1 the amounts are authorized to be appropriated in a subsequent fiscal year1 and shall remain available until expended4 ,,ii ,clean water infrastructure #bja4 ,treatment works risk and resilience 7a7 ,in general ,title ,,ii of the ,federal ,water ,pollution ,control ,act 7#cc ,u4,s4,c4 #abha et seq47 is amended by adding at the end the following3 #bbh4 ,treatment works risk and resilience 7a7 ,definitions ,in this section3 7#a7 ,covered treatment works ,the term covered treatment works means a treatment works that-- 7,a7 treats domestic sewage2 7,b7 serves more than #aj1jjj persons2 and 7,c7 has a design flow rate of #a1jjj1jjj gallons or more4 7#b7 ,natural hazard ,the term natural hazard means a natural event that threatens the functioning of a treatment works1 including an earthquake1 tornado1 flood1 hurricane1 wildfire1 and hydrologic changes4 7#c7 ,resilience ,the term resilience means the ability of a treatment works or an asset of a treatment works to adapt to1 or withstand the effects of1 a malevolent act or natural hazard without interruption to the function of the treatment works or asset or1 if the function is interrupted1 to rapidly return to a normal operating condition4 7#d7 ,state 7,a7 ,in general ,the term ,state means a ,state that has assumed primary enforcement responsibility pursuant to section #bbi7;e74 7,b7 ,enforcement by the ,administrator ,if a ,state has not assumed primary enforcement responsibility pursuant to section #bbi7;e71 the term ,state shall1 for purposes of obligations of the ,state under this subsection1 be considered to be a reference to the ,administrator4 7b7 ,risk and resilience assessments 7#a7 ,in general ,each covered treatment works shall conduct an assessment of the risks to1 and resilience of1 the covered treatment works4 7#b7 ,requirements ,an assessment under paragraph 7#a7-- 7,a7 shall include an assessment of-- 7i7 the risk to the covered treatment works from malevolent acts and natural hazards2 7ii7 the resilience of collection systems1 pipes and constructed conveyances1 physical barriers1 treatment1 and storage1 discharge1 and reuse facilities that are utilized by the covered treatment works2 7iii7 the monitoring practices of the covered treatment works2 7iv7 the financial infrastructure of the covered treatment works2 7v7 the use1 storage1 or handling of various chemicals by the covered treatment works2 7vi7 the operation and maintenance of the covered treatment works2 and 7vii7 using a method approved by the applicable ,state1 the risks to electronic1 computer1 or other automated systems for the purpose of identifying significant cybersecurity risks that have the potential to cause the impacts described in subparagraph 7,a7 or 7,b7 of paragraph 7#c72 and 7,b7 may include an evaluation of capital and operational needs for risk and resilience management for the covered treatment works4 7#c7 ,baseline information ,the ,administrator1 not later than #a year after the date of enactment of this section1 after consultation with appropriate departments and agencies of the ,federal ,government and with ,state and local governments1 shall provide baseline information on malevolent acts of relevance to covered treatment works1 which shall include consideration of acts that may-- 7,a7 substantially disrupt the ability of a covered treatment works to provide safe and reliable collection1 storage1 treatment1 recycling1 and reclamation of municipal sewage or industrial wastes2 or 7,b7 otherwise present significant public health or economic concerns to the community served by a covered treatment works4 7#d7 ,review and revision 7,a7 ,in general ,each covered treatment works shall1 not less frequently than once every #e years1 review and1 if necessary1 revise the assessment4 7,b7 ,certification to the ,administrator or ,state ,on completion of the review under subparagraph 7,a71 a covered treatment works shall submit to the applicable ,state a certification that the covered treatment works has reviewed and1 if applicable1 revised the assessment4 7c7 ,emergency response plan 7#a7 ,in general ,each covered treatment works shall prepare an emergency response plan that incorporates findings of the assessment conducted under subsection 7b7 for that covered treatment works 7or any revisions to that assessment74 7#b7 ,required inclusions ,the emergency response plan of a covered treatment works under paragraph 7#a7 shall include-- 7,a7 strategies and resources to improve the resilience of the covered treatment works1 including the physical security of the covered treatment works2 7,b7 plans and procedures that can be implemented1 and identification of equipment that can be utilized1 in the event of a malevolent act or natural hazard that threatens the ability of the covered treatment works to collect1 store1 treat1 recycle1 and reclaim municipal sewage or industrial wastes2 7,c7 actions1 procedures1 and equipment that can obviate or significantly lessen the impact of a malevolent act or natural hazard on the public health and the collection1 storage1 treatment1 recycling1 and reclamation of municipal sewage or industrial wastes2 7,d7 strategies that can be used to aid in the detection of malevolent acts or natural hazards that threaten the security or resilience of the covered treatment works2 and 7,e7 countermeasures that the covered treatment works intends to adopt or1 if already in use1 maintain to mitigate the significant cybersecurity risks identified under subsection 7b77#b77;,a77vii71 including a schedule the covered treatment works intends to follow to adopt any countermeasures not already in use by the covered treatment works4 7#c7 ,revision ,a covered treatment works shall review and1 as necessary1 revise the emergency response plan prepared under this subsection not less frequently than once every #e years4 7d7 ,submission and approval of assessments and plans 7#a7 ,submission 7,a7 ,in general ,beginning not later than #a year after the date on which the ,administrator provides baseline information under subsection 7b77#c71 each covered treatment works shall1 during a cybersecurity assessment pursuant to section #bbi7;b77#b77;,a71 provide to the applicable ,state-- 7i7 the portion of the assessment prepared under subsection 7b7 that is described in paragraph 7#b77;,a77vii7 of that subsection 7including any revision to that portion of the assessment72 and 7ii7 the portion of the emergency response plan prepared under subsection 7c7 that is described in paragraph 7#b77;,e7 of that subsection 7including any revision to that portion of the emergency response plan74 7,b7 ,limitation ,neither the ,administrator nor a ,state may require the submission of any portion of an assessment under subsection 7a7 or an emergency response plan under subsection 7b7 that is not described in subparagraph 7,a74 7#b7 ,review2 approval 7,a7 ,in general ,a ,state shall-- 7i7 review the portions of the assessments and emergency response plans of covered treatment works submitted pursuant to paragraph 7#a77;,a7 for conformity with the requirements of this section and section #bbi2 and 7ii7 7,i7 approve of the portions of an assessment and emergency response plan submitted pursuant to paragraph 7#a77;,a72 or 7,,ii7 disapprove of the portions of an assessment or emergency response plan submitted pursuant to paragraph 7#a77;,a7 if the ,administrator or the ,state1 as applicable1 determines that-- 7aa7 the submitted portions of the assessment or emergency response plan are missing1 incomplete1 or fail to conform with the requirements of this section2 or 7bb7 the submitted portions of the assessment or emergency response plan fail to provide for cybersecurity resilience in accordance with the baseline cybersecurity standards established by the ,administrator under section #bbi7;c74 7,b7 ,enforcement ,a ,state may use appropriate enforcement mechanisms under this ,act or the appropriate ,state authority to remedy noncompliance1 as described in items 7aa7 and 7bb7 of subparagraph 7,a77ii77,,ii71 under this subsection4 7#c7 ,submitted documentation 7,a7 ,applicability of ,,foia ,any information submitted under this subsection shall be exempt from disclosure under section #eeb7;b77#c7 of title #e1 ,united ,states ,code 7commonly known as the ,freedom of ,information ,act71 and any provision of ,state1 ,tribal1 or local freedom of information law1 open government law1 open meetings law1 open records law1 sunshine law1 or similar law requiring disclosure of information or records4 7,b7 ,treatment of documentation 7i7 ,protocol development ,not later than #ahj days after the date of enactment of the ,water ,cyber ,shield ,act of #bjbf and before any cybersecurity assessments are carried out pursuant to section #bbi7;b77#b77;,a71 the ,administrator1 in consultation with appropriate ,federal law enforcement and intelligence officials1 shall develop such protocols as are necessary to protect any information provided under paragraph 7#a77;,a7 to the ,state4 7ii7 ,requirements for protocol ,the protocol developed under clause 7i7 shall ensure that-- 7,i7 each copy of the portions of an assessment and emergency response plan submitted pursuant to paragraph 7#a77;,a7 are kept in a secure location2 7,,ii7 only individuals designated by the applicable ,state may have access to copies of the portions of the assessment and emergency response plan submitted pursuant to paragraph 7#a77;,a72 and 7,,iii7 no copy of the portions of the assessment and emergency response plan submitted pursuant to paragraph 7#a77;,a7 shall be made available to anyone other than an individual designated by the applicable ,state4 7iii7 ,savings provision ,nothing in this subparagraph authorizes any person to withhold any information from ,congress or from a committee or subcommittee of ,congress4 7#d7 ,applicability of ,,foia ,any findings or plans 7including revisions and any related agency records and information that is designated as ,department of ,defense critical infrastructure security information under section #acj;e7b7 of title #aj1 ,united ,states ,code7 submitted under this subsection shall be exempt from disclosure under section #eeb7;b77#c7 of title #e1 ,united ,states ,code 7commonly known as the ,freedom of ,information ,act71 and any provision of ,state1 ,tribal1 or local freedom of information law1 open government law1 open meetings law1 open records law1 sunshine law1 or similar law requiring disclosure of information or records4 7e7 ,coordination ,a covered treatment works shall1 to the extent practicable1 coordinate with existing local planning committees established pursuant to the ,emergency ,planning and ,community ,right-,to-,know ,act of #aihf 7#db ,u4,s4,c4 #aajja et seq47 when preparing or revising an assessment or emergency response plan under this section4 7f7 ,record maintenance ,each covered treatment works shall maintain a copy of the assessment conducted under subsection 7b7 and the emergency response plan prepared under subsection 7c7 7including any revised assessment or plan7 for #e years after the date on which that assessment or plan is approved by the applicable ,state under this section4 7g7 ,guidance to small treatment works ,the ,administrator shall provide guidance and technical assistance to treatment works that are not covered treatment works on how to conduct resilience assessments1 prepare emergency response plans1 and address threats from malevolent acts and natural hazards that threaten to disrupt the collection1 storage1 treatment1 recycling1 and reclamation of municipal sewage or industrial wastes or significantly affect the public health4 4 7b7 ,federal enforcement ,section #cji of the ,federal ,water ,pollution ,control ,act 7#cc ,u4,s4,c4 #acai7 is amended in each of subsections 7a71 7c71 7d71 and 7g7 by inserting #bbh7;d71 before #cja1 each place it appears4 #bjb4 ,cybersecurity requirements for treatment works 7a7 ,in general ,title ,,ii of the ,federal ,water ,pollution ,control ,act 7#cc ,u4,s4,c4 #abha et seq47 7as amended by section #bja7;a77 is amended by adding at the end the following3 #bbi4 ,cybersecurity requirements 7a7 ,definitions ,in this section3 7#a7 ,covered treatment works ,the term covered treatment works has the meaning given the term in section #bbh7;a74 7#b7 ,cybersecurity incident ,the term cybersecurity incident means a malicious act or suspicious event that disrupts1 or attempts to disrupt1 the operation of programmable electronic devices and communication networks1 including hardware1 software1 and data that are essential to the cybersecurity resilience of a treatment works4 7#c7 ,cybersecurity resilience ,the term cybersecurity resilience means the ability of a treatment works to adapt to or withstand the effects of a cybersecurity incident without interruption to the treatment works's function1 or if the function is interrupted1 to rapidly return to a normal operating condition4 7#d7 ,state 7,a7 ,in general ,except for subsection 7e71 the term ,state means a ,state that has assumed primary enforcement responsibility pursuant to subsection 7e74 7,b7 ,enforcement by the ,administrator ,if a ,state has not assumed primary enforcement responsibility pursuant to subsection 7e71 the term ,state shall1 for purposes of obligations of the ,state under this section 7except for subsection 7e771 be considered to be a reference to the ,administrator4 7b7 ,cybersecurity assessments 7#a7 ,assessments required 7,a7 ,in general ,a ,state shall carry out cybersecurity assessments of a covered treatment works in accordance with this paragraph4 7,b7 ,evaluation of adequacy ,for a covered treatment works subject to a cybersecurity assessment under subparagraph 7,a71 if the covered treatment works uses operational technology1 the ,state shall evaluate the adequacy of the cybersecurity of the operational technology1 and information and communications technology that is connected to the operational technology1 against the baseline cybersecurity standards promulgated by the ,administrator under subsection 7c74 7,c7 ,review of assessments and plans ,in carrying out a cybersecurity assessment required under subparagraph 7,a71 a covered treatment works shall provide1 and the ,state shall review1 the portions of the risk and resilience assessments of the covered treatment works under section #bbh7;b7 and the emergency response plans of the covered treatment works under section #bbh7;c7 submitted under section #bbh7;d77#a77;,a74 7,d7 ,inspections ,in carrying out cybersecurity assessments under this paragraph1 a ,state shall carry out inspections of a representative sample of covered treatment works each year1 which sampling shall be informed by risk-based considerations1 subject to the condition that the scope of the inspection is limited to the systems of the covered treatment works necessary to meet the requirements of this paragraph4 7#b7 ,violations ,if a ,state identifies a violation of the baseline cybersecurity standards established by the ,administrator under subsection 7c7 while conducting an assessment under paragraph 7#c71 the ,state shall take appropriate steps to ensure that the covered treatment works addresses the violation and use mechanisms1 including enforcement1 to correct those violations4 7#c7 ,submission to ,,epa 7,a7 ,in general ,a ,state shall annually submit to the ,administrator a report that summarizes the performance of the covered treatment works of the ,state for each cybersecurity performance metric established by the ,administrator under subsection 7d77#a7 based on the review by the ,state of risk and resilience assessments pursuant to paragraph 7#a77;,c74 7,b7 ,requirement ,a report submitted under subparagraph 7,a7 shall not identify any specific treatment works and shall include only aggregations of data4 7#d7 ,technical assistance ,the ,administrator shall1 on request of a covered treatment works1 provide guidance and technical assistance to the covered treatment works with respect to-- 7,a7 implementing any requirement under this section or section #bbh2 and 7,b7 enhancing cybersecurity resilience4 7c7 ,baseline cybersecurity standards 7#a7 ,in general ,the ,administrator shall by rulemaking establish baseline cybersecurity standards that shall serve as requirements to provide for the cybersecurity resilience of a covered treatment works4 7#b7 ,requirements ,in developing and establishing the baseline cybersecurity standards under paragraph 7#a71 the ,administrator shall1 at a minimum-- 7,a7 work in conjunction with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,director of the ,national ,institute of ,standards and ,technology2 7,b7 develop the baseline cybersecurity standards in collaboration with covered treatment works of various sizes and capacities to ensure that feedback from a variety of covered treatment works is considered during the development of the baseline cybersecurity standards2 7,c7 ensure that best practices and guidelines that already exist in the water sector at the time of the development of the baseline cybersecurity standards inform the development of the baseline cybersecurity standards2 7,d7 establish a technical advisory committee to provide input with respect to1 review1 and refine the baseline cybersecurity standards throughout the development process1 which shall1 at a minimum1 include-- 7i7 representatives from covered treatment works of various sizes2 7ii7 professional water associations2 7iii7 cybersecurity experts2 7iv7 a representative from a relevant voluntary consensus standards body1 as described in section #ab7;d77#a7 of the ,national ,technology ,transfer and ,advancement ,act of #aiie 7#ae ,u4,s4,c4 #bgb note2 ,public ,law #ajd-aac72 and 7v7 a representative from an information technology or operational technology service provider that provides cybersecurity services to covered treatment works2 and 7,e7 consult with the ,states4 7#c7 ,consideration of varied capacity and risk ,in developing the baseline cybersecurity standards under paragraph 7#a71 the ,administrator-- 7,a7 shall ensure that the baseline cybersecurity standards account for the varied capacity and risk of all covered treatment works2 and 7,b7 may establish different baseline cybersecurity standards for different categories of treatment works subject to assessments under subsection 7b7 based on capacity or risk4 7d7 ,cybersecurity performance metrics 7#a7 ,establishment of metrics 7,a7 ,in general ,not later than #b years after the date of enactment of this section1 the ,administrator shall establish cybersecurity performance metrics 7referred to in this subsection as the cybersecurity performance metrics7 to be used by the ,administrator to measure or assess how well the sector of treatment works in the ,united ,states is making progress on implementing cybersecurity best practices4 7,b7 ,assessment2 report ,the ,administrator shall1 not less frequently than once every #d years-- 7i7 assess the sector of treatment works in the ,united ,states using cybersecurity performance metrics2 and 7ii7 submit to ,congress and make publicly available a report describing1 on a generalized1 sector-wide basis1 the state of treatment works sector performance using the assessment carried out under clause 7i74 7#b7 ,provision of information ,notwithstanding any other provision of law1 a treatment works may1 at the discretion of the treatment works and for the purpose of developing sector-wide risk assessments and performance metrics to measure how treatment works are making progress in developing and implementing cybersecurity best practices1 provide to the ,administrator1 and the ,administrator may accept1 information that would assist the ,administrator in the development and maintenance of cybersecurity performance metrics4 7e7 ,enforcement2 state assumption of duties 7#a7 ,in general ,this section and section #bbh shall be enforced by the ,administrator unless a ,state assumes primary enforcement responsibility pursuant to this subsection4 7#b7 ,application ,a ,state seeking to assume primary enforcement responsibility pursuant to this subsection shall submit to the ,administrator an application at such time1 in such manner1 and containing such information as the ,administrator may by regulation require4 7#c7 ,determination ,on receiving an application described in paragraph 7#b7 from a ,state1 the ,administrator shall1 based on that application1 determine whether the ,state-- 7,a7 has adopted and is implementing adequate procedures for the enforcement of requirements that are no less stringent than those under this section and section #bbh2 7,b7 has adopted authority and has sufficient capacity to impose enforcement remedies in line with those prescribed under this title2 7,c7 has sufficient capacity and personnel with sufficient expertise to perform cybersecurity assessments and conduct reviews of risk and resilience assessments and emergency response plans under section #bbh2 and 7,d7 has sufficient security mechanisms in place to prevent any unsanctioned disclosure or dissemination of risk and resilience assessments1 emergency response plans1 and any other information provided by a covered treatment works1 in alignment with the protocols developed by the ,administrator under section #bbh7;d77#c77;,b77i74 7#d7 ,timeline ,not later than #ahj days after the date on which the ,administrator receives an application described in paragraph 7#b71 the ,administrator shall-- 7,a7 if the ,administrator determines that the ,state meets each requirement described in paragraph 7#c71 grant the application2 or 7,b7 if the ,administrator determines that the ,state fails to meet #a or more of the requirements described in paragraph 7#c71 deny the application4 7#e7 ,revocation of primary enforcement responsibility ,the ,administrator may1 as appropriate1 revoke an assumption of primary enforcement responsibility pursuant to this subsection if the ,administrator determines that a ,state no longer meets #a or more requirements described in paragraph 7#c74 7#f7 ,regulations required ,the ,administrator shall promulgate regulations carrying out this subsection not later than #a year after the date of enactment of this section1 which shall include-- 7,a7 the requirements for an application described in paragraph 7#b72 7,b7 the period for which a ,state may assume primary enforcement responsibility pursuant to this subsection before renewal2 and 7,c7 the manner by which the ,administrator may revoke primary enforcement responsibility pursuant to paragraph 7#e74 7#g7 ,savings provision ,an assumption of primary enforcement responsibility pursuant to this subsection shall be separate from any responsibility otherwise assumed under this ,act4 4 7b7 ,inspections ,section #cjh7;a7 of the ,federal ,water ,pollution ,control ,act 7#cc ,u4,s4,c4 #acah7;a77 is amended1 in the matter preceding subparagraph 7,a7-- 7#a7 by striking or 7#d7 carrying and inserting 7#d7 carrying2 and 7#b7 by striking #ejd of this ,act-- and inserting #ejd2 or 7#e7 carrying out requirements under section #bbi--4 7c7 ,federal enforcement ,section #cji of the ,federal ,water ,pollution ,control ,act 7#cc ,u4,s4,c4 #acai7 7as amended by section #bja7;b77 is amended in each of subsections 7a71 7c71 7d71 and 7g7 by inserting #bbi1 before #cja1 each place it appears4 #bjc4 ,clean water security assistance 7a7 ,authorization of appropriations ,in addition to any amounts authorized to be appropriated under section #fjg of the ,federal ,water ,pollution ,control ,act 7#cc ,u4,s4,c4 #achg71 there is authorized to be appropriated #cjj1jjj1jjj for each of fiscal years #bjbg through #bjcb for the purposes of helping treatment works 7as defined in section #bab of that ,act 7#cc ,u4,s4,c4 #abib77 build cybersecurity resilience 7as defined in section #bbi of the ,federal ,water ,pollution ,control ,act7 and identifying and mitigating cybersecurity vulnerabilities1 including those included in risk and resilience assessments and emergency response plans prepared pursuant to section #bbh of that ,act4 7b7 ,guidance ,the ,administrator of the ,environmental ,protection ,agency may issue guidance to determine specific criteria for eligible uses of the amounts made available under subsection 7a7 that further the purposes described in that subsection4 7c7 ,prioritization ,in using amounts made available pursuant to subsection 7a71 a ,state shall prioritize providing assistance to treatment works 7as defined in section #bab of the ,federal ,water ,pollution ,control ,act 7#cc ,u4,s4,c4 #abib77 that have the greatest need with respect to capacity1 workforce1 expertise1 or resources to adequately address cybersecurity vulnerabilities4 7d7 ,rollover ,to the extent that any amounts authorized to be appropriated under subsection 7a7 in a fiscal year are not appropriated in that fiscal year1 the amounts are authorized to be appropriated in a subsequent fiscal year1 and shall remain available until expended4 ,,iii ,cyber incident reporting obligations #cja4 ,cyber incident reporting ,subtitle ,d of title ,,xxii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fha et seq47 is amended-- 7#a7 in section #bbdj 7#f ,u4,s4,c4 #fha71 by striking paragraph 7#d7 and inserting the following3 7#d7 ,covered entity ,the term covered entity-- 7,a7 means an entity in a critical infrastructure sector1 as defined in ,presidential ,policy ,directive #ba1 that satisfies the definition established by the ,director in the final rule issued pursuant to section #bbdb7;b72 and 7,b7 includes-- 7i7 a community water system 7as defined in section #adja of the ,safe ,drinking ,water ,act 7#db ,u4,s4,c4 #cjj;f77 that serves a population of greater than #c1cjj persons2 and 7ii7 a covered treatment works 7as defined in section #bbh7;a7 of the ,federal ,water ,pollution ,control ,act74 2 7#b7 in section #bbdb7;a7 7#f ,u4,s4,c4 #fha;b7a771 by adding at the end the following3 7#h7 ,transmission to ,,epa ,the ,agency shall submit to the ,administrator of the ,environmental ,protection ,agency a copy of each report submitted to the ,agency under paragraph 7#a71 7#b71 or 7#c74 2 and 7#c7 in section #bbdd7;f7 7#f ,u4,s4,c4 #fha;d7f77-- 7,a7 by striking ,this section and inserting the following3 7#a7 ,in general ,except as provided in paragraph 7#b71 this section 2 and 7,b7 by adding at the end the following3 7#b7 ,exception ,this section shall apply to a ,state1 local1 ,tribal1 or territorial government entity that is required to submit a report under section #bbdb7;a7 with respect to a community water system or covered treatment works1 as defined in clauses 7i7 and 7ii71 respectively1 of section #bbdj7d77;,b71 that is owned or operated by the ,state1 local1 ,tribal or territorial government entity4 4